New Employee IT Onboarding Checklist: Which Accounts to Create, What Access to Grant and What to Avoid

IT onboarding for a new employee means creating their identity for business email, shared files, line-of-business apps and door access, and giving each one only the access their role needs. A sound process starts from a single request raised by HR, applies a ready-made access set for the department, lets the employee choose their own password and reviews everything at the end of the first week.

Key takeaways

• Account setup should start once the HR record is confirmed and be finished before the new starter's first morning.
• Access is best granted through predefined sets per department and role, not added person by person.
• According to the Microsoft Digital Defense Report 2025, more than 97% of identity attacks are password attacks, which makes the day-one password handover a genuine security step.
• Passwords for shared mailboxes or shared accounts should never be passed to a new starter, verbally or in writing.
• Every account you open should be logged; that log becomes the list of what to close when the person eventually leaves.

Why are a new starter's accounts a risk from day one?

Recruitment gets planned carefully; account setup is left to the last minute. The new hire finds no mailbox and no shared drive, and a colleague says "just use my login for now" — a stopgap that can quietly become months of shared credentials.

The cost goes beyond a lost morning. The Microsoft Digital Defense Report 2025 found that more than 97% of identity attacks are password attacks, and that phishing-resistant multifactor authentication can stop over 99% of them. Verizon's 2026 Data Breach Investigations Report shows that the use of stolen credentials held steady as an action in 36% of breaches.

New starters are often among the softest targets in that picture. They do not yet know your systems, find it harder to tell a genuine IT email from a fake one and, in their first week, are more inclined to follow a "verify your account" message. Treat onboarding as the first step of your security process; the password side is covered in our guide to business password security.

Which accounts does a new employee need?

Most small and mid-sized firms need the same handful of items; the table below is a reasonable day-one starting point.

The column that matters most is "day-one access". Adding a permission later takes a few minutes; spotting and removing one that was granted by mistake usually never happens at all.

How does the onboarding process work, step by step?

A good process relies on a written sequence, not memory. These steps scale from a ten-person office to a site of several hundred.

1. Take requests through one channel: HR sends IT the name, job title, department, start date and line manager on a single form, at least a few working days before the start date. Requests arriving by email, phone and in the corridor cannot be tracked separately.
2. Pick the access set for the role: For each role, such as "finance", "sales" or "field", the mailboxes, folders and apps to open are already written down.
3. Create accounts with restricted defaults: The personal mailbox and team areas are opened; delete, export and admin rights stay off.
4. Let the employee set the password: Issue a one-time sign-in link or code and have the person choose their own permanent password. If you use multi-factor authentication, enrol it at first sign-in.
5. Set up physical access: Configure the access card for the person's work area and shift; time and attendance records start on the same card.
6. Run a short induction on day one: Fifteen minutes is enough to explain how genuine IT messages look, where to report something suspicious and why passwords are never shared.
7. Log every account you create: Which account, on what date, approved by whom? This log is your list of accounts to close when the person leaves.
8. Review at the end of week one: Add what is missing and remove what is not being used.

The last two steps are the ones most often skipped. Yet the answer to "where did this person have accounts?" on their final day lives in the log you kept on their first; the leaver side is covered in offboarding all employee accounts.

How much access should a new starter get on day one?

The rule is simple: people start with enough access to do the job, then request more, with approval, as the need arises. This is the principle of least privilege, and it matters most for new starters because nobody yet knows exactly what they will need.

Shared mailboxes and shared folders cause the most trouble in practice. A finance folder opened to "everyone for now" can stay that way for years. We explain what each folder permission really means in our file sharing permissions guide, and the mailbox side in mailbox permissions and delegation.

Tying access to departments rather than individuals makes onboarding faster and more consistent: joiners inherit the department's access, and movers lose the old access automatically.

How should passwords and sign-in be handed over?

The most common mistake is writing the password on a sticky note, or emailing it to the line manager. At least two people now know it, and it is rarely changed. The right approach is for the employee to set their own password at first sign-in.

The second mistake is a separate password for every application. A new starter who must learn five passwords in week one will reuse one or write them all down. Single sign-on (SSO) removes that burden by letting people reach every work app with one identity; the benefits and limits are in our piece on single sign-on.

Finally, if work email goes on a personal phone, make sure a session on a lost phone can be signed out remotely.

How should the HR-to-IT handover be set up?

Onboarding starts in HR, is carried out by IT and is approved by the line manager. Without a single shared record between the three, the same details are requested again for every new hire. Holding employee data in the HR system and passing it to IT as an automatic request saves the most time; see our HR software selection guide for what to look for.

That handover also moves personal data around: ID details, address, photo, card number. Employees need a privacy notice at the point of hiring, and the data should only reach the people who need it. The detail is in our guide to employee personal data under KVKK.

How do you onboard a new employee with Smart360?

Smart360 is Digital Bridge's family of business applications: SmartMail (business email), SmartFiles (file management), SmartOperator (an AI customer agent for your website) and SmartPass (door access and time and attendance) are all run from one organisation panel. To onboard someone, an administrator invites them from the Team section of the organisation panel and assigns their role and department. Departments are defined once, so permissions across the products follow from that assignment.

Say a new hire joins finance. As soon as they are added to the department they pick up its permissions in the finance workspace in SmartFiles, because access granted to a department applies to everyone who joins later. In SmartMail they open the accounts@ mailbox with their own Smart360 identity and never see the mailbox password. Delete and quarantine rights are off by default for a new assignment, and AI features are a separate permission granted person by person.

Administrators never hand out passwords: employees set their own and use a single identity (SmartID) to move between products without signing in again. Open sessions are listed with their device details and can be signed out remotely. When the organisation adds another Smart product later, nobody has to be set up again and no new passwords go out.

On the door side, you also sign in to the SmartPass panel with your Smart360 identity, with no separate password. The new starter is added to SmartPass as a person, issued a card and placed in an access group, optionally with a weekly time profile; door access and attendance run on the same card. On leaving day, a Smart360 administrator closes their software access in one place, however many products they used, while their card is cancelled or the person deactivated in SmartPass, and the change reaches the doors within seconds.

How can Digital Bridge help?

Often the gap in a joiner process is not software but unclear ownership of approvals. Through our cyber security consultancy, Digital Bridge works with you to write role-based access sets, a password and sign-in policy, and joiner and leaver checklists.

If you want HR data to turn into IT requests automatically, our HR, payroll and personnel management software service builds that flow around your existing systems. For the short security induction new starters need, our security awareness training programme guide is a good place to begin.

What is the next step for your onboarding process?

Think back to your last three new starters: were accounts ready on day one, who learned which password from whom, and which "temporary" permission was forgotten? The answers show where the process breaks down. More on running processes digitally sits on our digital transformation topic page.

If you would like to manage users, departments and product access from one panel, explore the Smart360 family on its product page and get started with the product you need via the Smart360 Buy Now page. To buy SmartPass for door access and time and attendance, fill in the SmartPass form. To plan your roles and permissions with us, get in touch via our contact page or call +90 850 346 41 09.